Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 121:

  An analyst wants to run a script to remove usernames from an incident before the incident becomes active in XSOAR. How can this be achieved?

  A. Run an automation script in the Playground to remove usernames from the incident.

  B. Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.

  C. Run an automation script on the XSOAR server to remove usernames from the incident.

  D. Create a playbook task to remove the usernames from the incident.

  Correct Answer: B

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Incident-Management

• Question 122:

  Who is permitted to create and submit content to the Marketplace?

  A. Only users with a valid Github account

  B. Any user who has signed up through the dev portal

  C. Any user who has a live.paloaltonetworks.com account

  D. All users with the correct XSOAR Role and Permissions

  Correct Answer: D

• Question 123:

  During configuration of the inputs of a sub-playbook in the main playbook, there is an option under the Loop tab called "For Each Input". What is this option used to?

  A. To loop the sub-playbook over all context values present in the investigation

  B. To loop the sub-playbook over all incident fields for the given incident

  C. To loop the sub-playbook over all the fields marked as important

  D. To loop the sub-playbook over all defined sub-playbook inputs

  Correct Answer: D

• Question 124:

  Which of the following is a feature of XSOAR automations?

  A. can run on multiple docker containers

  B. can be set to run on a scheduled basis in the automation settings

  C. can be password protected

  D. can be written in C++

  Correct Answer: B

  Reference: https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar-overview

• Question 125:

  What is the function of timer SLA fields in Cortex XSOAR?

  A. To track SLA breaches per playbook

  B. To run a script that executes on SLA assignment

  C. To automatically alert the analyst on SLA breach

  D. To count the time between one or more tasks

  Correct Answer: C

  Reference: https://docs-cortex.paloaltonetworks.com/cortex/cortex-xsoar//6-2/cortex-xsoar- admin/work-with-slas/create-an-sla-field

• Question 126:

  Which development languages are supported when creating XSOAR automation scripts?

  A. C++, Python, Powershell

  B. Ruby, C++, Python

  C. Javascript, Powershell, C++

  D. Python, Powershell, Javascript

  Correct Answer: D

• Question 127:

  Which built-in automation/command cab be used to change an incident's type?

  A. setIncident

  B. Set

  C. GetFieldsByIncidentType

  D. modifyIncidentFields

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/incidents/incidents- management/incident-fields/field-trigger-scripts.html

• Question 128:

  What happens when an integration is deprecated?

  A. The integration commands in a playbook can no longer be used

  B. The integration commands can be used, but it is recommended to update to the latest content pack

  C. The configuration settings will be lost and the integration will no longer function

  D. The integration commands in a playbook can be used, but it will fail at runtime

  Correct Answer: B

• Question 129:

  The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

  A. Using the demisto_error() function

  B. Using a print statement

  C. Using the demisto.debug() function

  D. Using the return_error() function

  Correct Answer: C

• Question 130:

  Management would like to get an incident report automatically following an incident's closure. How would this be accomplished?

  A. Define a task in a playbook to generate an incident report before the closure occurs

  B. Manually create an `Incident Report'

  C. Configure post-processing using a script

  D. Create an `Incident Report' from the Reports page

  Correct Answer: C